Linux Distros Unpatched Vulnerability : CVE-2026-90225

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfc: llcp: read llcpsock-local under the socket lock in getsockopt nfcllcpgetsockopt read llcpsock-local before locksocksk and then dereferenced the cached...

Linux Distros Unpatched Vulnerability : CVE-2026-90157

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reject negative optlen in cgroup getsockopt hook A cgroup getsockopt BPF program can shrink ctx-optlen after the kernel getsockopt handler has run. The...

AZL-102590 CVE-2026-90157 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative optlen in cgroup getsockopt hook A cgroup getsockopt BPF program can shrink ctx-optlen after the kernel getsockopt handler has run. The kernel-buffer variant, used by TCPZEROCOPYRECEIVE, only rejects values...

CVE-2026-90327 phonet: pep: do not write beyond optlen in getsockopt

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: do not write beyond optlen in getsockopt pepgetsockopt clamps the reported length to the caller's buffer with mint, but then stores the value with putuserval, int user optval, which always writes sizeofint bytes. A...

EUVD-2026-81819

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: avoid userspace overflow on invalid optlen nfcllcpgetsockopt casts optval to u32 user for putuser, so the kernel always stores 4 bytes regardless of the caller-supplied optlen. The existing mintu32, len, sizeofu32 only...

CVE-2026-90226

CVE-2026-90226 affects the Linux kernel NFC LLCP subsystem . In nfc_llcp_getsockopt(), the kernel unconditionally stores 4 bytes via put_user() regardless of the caller-supplied optlen, because the existing min_t(u32, len, sizeof(u32)) only clamps the reported length but not the actual write. A c...

CVE-2026-90225 nfc: llcp: read llcp_sock->local under the socket lock in getsockopt

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: read llcpsock-local under the socket lock in getsockopt nfcllcpgetsockopt read llcpsock-local before locksocksk and then dereferenced the cached pointer inside the locked region. llcpsockbind assigns and clears...

EUVD-2026-81750

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative optlen in cgroup getsockopt hook A cgroup getsockopt BPF program can shrink ctx-optlen after the kernel getsockopt handler has run. The kernel-buffer variant, used by TCPZEROCOPYRECEIVE, only rejects values...

CVE-2026-90157

CVE-2026-90157 affects the Linux kernel BPF cgroup getsockopt hook. A cgroup getsockopt BPF program can shrink ctx->optlen after the kernel getsockopt handler runs. The kernel-buffer variant (used by TCP_ZEROCOPY_RECEIVE ) only rejects values larger than the original length, so a negative optl...

CVE-2026-90093 Bluetooth: L2CAP: access chan->conn safely in get/setsockopt

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: access chan-conn safely in get/setsockopt Since commit b66774b48dd9 "Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref" l2capchan::conn has held reference and remains non-NULL also after the...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

The dotlsgetsockopt function in net/tls/tlsmain.c in the Linux kernel, up to version 6.2.6, lacks a locksock call, resulting in a race condition. This can lead to a use-after-free issue or a NULL pointer dereferencing...

UBUNTU-CVE-2026-89583

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eirgetservicedata eirgetservicedata walks the advertising data for a Service Data field with a matching UUID. On a mismatch it advances: eir += dlen; eirlen -= dlen; eirgetdata reports dlen as the...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

A vulnerability was identified in the Linux Kernel versions up to 4.19.316/5.4.278/5.10.220/5.15.161. This affects the tcpgetsockopt/tcpsetsockopt functions of the TCP Handler component. Such manipulation leads to a race condition. This attack involves a high level of complexity. The vulnerabilit...

Astra Linux – Vulnerability in Linux, Linux 5.10

A use-after-free read flaw was discovered in the sockgetsockopt function in net/core/sock.c, due to race conditions involving SOPEERCRED and SOPEERGROUPS functions when used with listen and connect in the Linux kernel. In this flaw, an attacker with user privileges could potentially crash the...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100543)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100543 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: fix OOB write to userspace in sctpgetsockoptpeerauthchunks sctpgetsockoptpeerauthchunks...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100590)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100590 advisory. In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix locking in .getsockopt Mirror iucvsocksetsockopt and wrap the whole switch in...

CVE-2026-8718

tlsoptdtlspeerconnectionidvalueget in subsys/net/lib/sockets/socketstls.c, which handles getsockoptSOLTLS, TLSDTLSPEERCIDVALUE, passed the caller-supplied optval directly to mbedtlssslgetpeercid without verifying the buffer was at least MBEDTLSSSLCIDOUTLENMAX default 32 bytes. mbedtlssslgetpeerci...

CVE-2026-8718

tlsoptdtlspeerconnectionidvalueget in subsys/net/lib/sockets/socketstls.c, which handles getsockoptSOLTLS, TLSDTLSPEERCIDVALUE, passed the caller-supplied optval directly to mbedtlssslgetpeercid without verifying the buffer was at least MBEDTLSSSLCIDOUTLENMAX default 32 bytes. mbedtlssslgetpeerci...

CVE-2026-8718 Out-of-bounds write in DTLS peer Connection ID getsockopt (`TLS_DTLS_PEER_CID_VALUE`) in Zephyr net sockets/TLS

tlsoptdtlspeerconnectionidvalueget in subsys/net/lib/sockets/socketstls.c, which handles getsockoptSOLTLS, TLSDTLSPEERCIDVALUE, passed the caller-supplied optval directly to mbedtlssslgetpeercid without verifying the buffer was at least MBEDTLSSSLCIDOUTLENMAX default 32 bytes. mbedtlssslgetpeerci...

CVE-2026-8718

CVE-2026-8718 affects Zephyr net sockets TLS with CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID and an established DTLS session. tls_opt_dtls_peer_connection_id_value_get() passes optval to mbedtls_ssl_get_peer_cid() without ensuring the destination buffer is large enough (MBEDTLS_SSL_CID_OUT_LEN_MAX, de...